From 1311884ca08b4989fd22f2ec4dcabe5e443f8a97 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Fri, 13 Oct 2023 14:41:53 +1000 Subject: [PATCH] Adding 2 new analytics and updating 4 others --- .../user_added_to_privileged_group.yml | 54 +++++++++++++++++ .../detect_new_local_admin_account.yml | 13 ++-- ...ows_ad_domain_replication_acl_addition.yml | 21 +++++-- ...n_default_group_policy_object_modified.yml | 8 +-- ...dows_admon_group_policy_object_created.yml | 6 +- .../windows_vulnerable_driver_installed.yml | 60 +++++++++++++++++++ 6 files changed, 146 insertions(+), 16 deletions(-) create mode 100644 detections/application/user_added_to_privileged_group.yml create mode 100644 detections/endpoint/windows_vulnerable_driver_installed.yml diff --git a/detections/application/user_added_to_privileged_group.yml b/detections/application/user_added_to_privileged_group.yml new file mode 100644 index 0000000000..7589e6d7ee --- /dev/null +++ b/detections/application/user_added_to_privileged_group.yml @@ -0,0 +1,54 @@ +name: User Added to Privileged Group +id: 187bf937-c436-4c65-bbcb-7539ffe02da1 +version: 1 +date: '2023-09-27' +author: Dean Luxton +status: production +type: TTP +data_source: +- XmlWinEventLog:Security +description: Detect users added to privileged AD Groups. +search: '`wineventlog_security` EventCode IN (4728) + | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) + as user_category values(src_user_category) as src_user_category by signature, Group_Name, + src_user, dest + | lookup admon_groups_def cn as Group_Name OUTPUT category + | where category="privileged" | `user_added_to_privileged_group_filter`' +how_to_implement: This analytic requires eventCode 4728 to be ingested along with the admon_groups_def lookup being configured to include a list of AD groups along with a category to identify privileged groups. + See splunkbase for further details. +known_false_positives: None +references: +- https://splunkbase.splunk.com/app/6853 +tags: + analytic_story: + - UPDATE_STORY_NAME + asset_type: Endpoint + confidence: 100 + impact: 50 + message: $user$ was added to privileged AD Group $Group_Name$ by $src_user$ + mitre_attack_id: + - T1098 + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 50 + required_fields: + - EventCode + - user + - src_user + - signature + - Group_Name + - dest + security_domain: identity +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index 809f182451..4855aa97ec 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -10,10 +10,11 @@ description: This search looks for newly created accounts that have been elevate data_source: - Windows Security 4732 - Windows Security 4720 -search: '`wineventlog_security` EventCode=4720 OR (EventCode=4732 Group_Name=Administrators) - | transaction member_id connected=false maxspan=180m | rename member_id as user - | stats count min(_time) as firstTime max(_time) as lastTime by user dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `detect_new_local_admin_account_filter`' +search: '`wineventlog_security` (EventCode=4720) OR (EventCode=4732 Group_Name=Administrators) +| stats dc(EventCode) as evCount min(_time) as _time range(_time) as duration values(src_user) as src_user values(src_user_category) as src_user_category values(dest_category) as dest_category by user dest +| where evCount=2 AND duration<7200 +| fields - evCount, duration +| `detect_new_local_admin_account_filter`' how_to_implement: You must be ingesting Windows event logs using the Splunk Windows TA and collecting event code 4720 and 4732 known_false_positives: The activity may be legitimate. For this reason, it's best @@ -70,3 +71,7 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/xml-windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + update_timestamp: true \ No newline at end of file diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index f85aedefbd..dcfa4a7224 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -4,8 +4,9 @@ version: 1 date: "2022-11-18" author: Dean Luxton type: TTP -status: experimental -data_source: [] +status: production +data_source: +- Windows Security 5136 description: This analytic detects the addition of the permissions necessary to perform a DCSync attack. In order to replicate AD objects, the initiating user or computer must have the following permissions on the domain. @@ -13,9 +14,19 @@ description: - DS-Replication-Get-Changes-All Certain Sync operations may require the additional permission of DS-Replication-Get-Changes-In-Filtered-Set. By default, adding DCSync permissions via the Powerview Add-ObjectACL operation adds all 3. This alert identifies where this trifecta has been met, and also where just the base level requirements have been met. -search: '`wineventlog_security` | rex field=AttributeValue max_match=10000 "OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;(?PS-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3})\)"| table _time dest src_user DSRGetChanges_user_sid DSRGetChangesAll_user_sid DSRGetChangesFiltered_user_sid| mvexpand DSRGetChanges_user_sid| eval minDCSyncPermissions=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid,"true","false"), fullSet=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid AND DSRGetChanges_user_sid=DSRGetChangesFiltered_user_sid,"true","false")| where minDCSyncPermissions="true" | lookup identity_lookup_expanded objectSid as DSRGetChanges_user_sid OUTPUT sAMAccountName as user | rename DSRGetChanges_user_sid as userSid | stats min(_time) as _time values(user) as user by dest src_user userSid minDCSyncPermissions fullSet| `windows_ad_domain_replication_acl_addition_filter`' -how_to_implement: - To successfully implement this search, you need to be ingesting the eventcode 5136. The Advanced Security Audit policy setting +search: '`wineventlog_security` EventCode=5136 + | rex field=AttributeValue max_match=10000 "OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;(?PS-1-[ 0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[ 1-9]\d{3})\)" + | rex field=AttributeValue max_match=10000 "OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;(?PS-1-[ 0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[ 1-9]\d{3})\)" + | rex field=AttributeValue max_match=10000 "OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;(?PS-1-[ 0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[ 1-9]\d{3})\)" + | table _time dest src_user DSRGetChanges_user_sid DSRGetChangesAll_user_sid DSRGetChangesFiltered_user_sid\ + | mvexpand DSRGetChanges_user_sid + | eval minDCSyncPermissions=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid,"true","false"), fullSet=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid AND DSRGetChanges_user_sid=DSRGetChangesFiltered_user_sid,"true","false") + | where minDCSyncPermissions="true" + | lookup identity_lookup_expanded objectSid as DSRGetChanges_user_sid OUTPUT sAMAccountName as user + | rename DSRGetChanges_user_sid as userSid + | stats min(_time) as _time values(user) as user by dest src_user userSid minDCSyncPermissions fullSet + | `windows_ad_domain_replication_acl_addition_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting the eventcode 5136. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody` to `Write All Properties` applied to the domain root and all descendant objects. Once the necessary logging has been enabled, enumerate the domain policy to verify if existing accounts with access need to be whitelisted, or revoked. Assets and Identities is also leveraged to automatically translate the objectSid into username. diff --git a/detections/endpoint/windows_admon_default_group_policy_object_modified.yml b/detections/endpoint/windows_admon_default_group_policy_object_modified.yml index dcdf571444..2301e8872b 100644 --- a/detections/endpoint/windows_admon_default_group_policy_object_modified.yml +++ b/detections/endpoint/windows_admon_default_group_policy_object_modified.yml @@ -11,9 +11,9 @@ description: The following analytic leverages Splunks Admon to identify the modi The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the modification of the default GPOs. search: ' `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" (displayName="Default Domain Policy" OR displayName="Default Domain Controllers Policy") - | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath) by dcName, displayName - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | appendpipe [ + | map search="search `wineventlog_security` EventCode=5136 AttributeSyntaxOID=2.5.5.12 AttributeValue=$displayName$" | rename AttributeValue as displayName] + | stats min(_time) as _time values(displayName) as gp_name, values(gPCFileSysPath) as gPCFileSysPath, values(src_user) as src_user, values(dest) as dest, values(dest_category) as dest_category, values(src_user_category) as src_user_category by displayName | `windows_admon_default_group_policy_object_modified_filter`' how_to_implement: To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory @@ -58,4 +58,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security.log source: ActiveDirectory - sourcetype: ActiveDirectory \ No newline at end of file + sourcetype: ActiveDirectory diff --git a/detections/endpoint/windows_admon_group_policy_object_created.yml b/detections/endpoint/windows_admon_group_policy_object_created.yml index a535c1bd49..95bd6ca87e 100644 --- a/detections/endpoint/windows_admon_group_policy_object_created.yml +++ b/detections/endpoint/windows_admon_group_policy_object_created.yml @@ -11,9 +11,9 @@ description: The following analytic leverages Splunks Admon to identify the crea deploy malware across an Active Directory network. As an example, the Lockbit ransomware malware will create new group policies on the domain controller that are then pushed out to every device on the network. Security teams should monitor the creation of new Group Policy Objects. search: ' `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" versionNumber=0 displayName!="New Group Policy Object" - | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath) by dcName, displayName - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | appendpipe [ + | map search="search `wineventlog_security` EventCode=5136 AttributeSyntaxOID=2.5.5.12 AttributeValue=$displayName$" | rename AttributeValue as displayName] + | stats min(_time) as _time values(displayName) as gp_name, values(gPCFileSysPath) as gPCFileSysPath, values(src_user) as src_user, values(dest) as dest, values(dest_category) as dest_category, values(src_user_category) as src_user_category by displayName | `windows_admon_group_policy_object_created_filter`' how_to_implement: To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory diff --git a/detections/endpoint/windows_vulnerable_driver_installed.yml b/detections/endpoint/windows_vulnerable_driver_installed.yml new file mode 100644 index 0000000000..846a30ccef --- /dev/null +++ b/detections/endpoint/windows_vulnerable_driver_installed.yml @@ -0,0 +1,60 @@ +name: Windows Vulnerable Driver Installed +id: 1dda7586-57be-4a1b-8de1-a9ad802b9a7f +version: 1 +date: '2023-09-27' +author: Dean Luxton +status: production +type: TTP +data_source: +- XmlWinEventLog System EventCode 7045 +description: The following analytic utilises a known list of vulnerable Windows drivers + to help defenders find potential persistence or privelege escalation via a vulnerable + driver. This analytic uses native windows system service install events to capture when the vulnerable driver is installed. + A known gap with this lookup is that it does not use the hash or known signer of the vulnerable driver + therefore it is up to the defender to identify version and signing info and confirm + it is a vulnerable driver. + This detection is a winventlog copy of the Sysmon driver loaded detection written by Michael Haag. +search: '`wineventlog_system` EventCode=7045 ServiceType="kernel mode driver" + | table _time dest EventCode ImagePath ServiceName ServiceType + | lookup loldrivers driver_name AS ImagePath OUTPUT is_driver driver_description + | search is_driver = TRUE | `windows_vulnerable_driver_installed`' +how_to_implement: Ensure the Splunk is collecting XmlWinEventLog:System events and the EventCode 7045 is being ingested. +known_false_positives: False positives may be present. Drill down into the driver + further by version number and cross reference by signer. Review the reference material + in the lookup. +references: +- https://loldrivers.io/ +- https://github.com/SpikySabra/Kernel-Cactus +- https://github.com/wavestone-cdt/EDRSandblast +- https://research.splunk.com/endpoint/a2b1f1ef-221f-4187-b2a4-d4b08ec745f4/ +- https://www.splunk.com/en_us/blog/security/these-are-the-drivers-you-are-looking-for-detect-and-prevent-malicious-drivers.html +tags: + analytic_story: + - Windows Drivers + asset_type: Endpoint + confidence: 50 + impact: 100 + message: Potentially vulnerable/malicious driver ($driver_name$) has been installed on $dest$ + mitre_attack_id: + - T1543.003 + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 50 + required_fields: + - ServiceType + - driver_name + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1014/windows-system.log + source: XmlWinEventLog:System + sourcetype: XmlWinEventLog + update_timestamp: true